Commit 267ef48e authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'tcp-some-bug-fixes-for-tcp_read_skb' 

Cong Wang says:

====================
tcp: some bug fixes for tcp_read_skb()

This patchset contains 3 bug fixes and 1 minor refactor patch for
tcp_read_skb(). V1 only had the first patch, as Eric prefers to fix all
of them together, I have to group them together.
====================

Link: https://lore.kernel.org/r/20220817195445.151609-1-xiyou.wangcong@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 6faee3d4 2e23acd9

net/core/skmsg.c

+3 −2
Original line number Diff line number Diff line
@@ -1194,8 +1194,9 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb) 
		ret = bpf_prog_run_pin_on_cpu(prog, skb);

		ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));

	}

	if (sk_psock_verdict_apply(psock, skb, ret) < 0)

		len = 0;

	ret = sk_psock_verdict_apply(psock, skb, ret);

	if (ret < 0)

		len = ret;

out:

	rcu_read_unlock();

	return len;

net/ipv4/tcp.c

+23 −26
Original line number Diff line number Diff line
@@ -1567,17 +1567,11 @@ static int tcp_peek_sndq(struct sock *sk, struct msghdr *msg, int len) 
 * calculation of whether or not we must ACK for the sake of

 * a window update.

 */

void tcp_cleanup_rbuf(struct sock *sk, int copied)

static void __tcp_cleanup_rbuf(struct sock *sk, int copied)

{

	struct tcp_sock *tp = tcp_sk(sk);

	bool time_to_ack = false;



	struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);



	WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),

	     "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",

	     tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);



	if (inet_csk_ack_scheduled(sk)) {

		const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1623,6 +1617,17 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied) 
		tcp_send_ack(sk);

}



void tcp_cleanup_rbuf(struct sock *sk, int copied)

{

	struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);

	struct tcp_sock *tp = tcp_sk(sk);



	WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),

	     "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",

	     tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);

	__tcp_cleanup_rbuf(sk, copied);

}



static void tcp_eat_recv_skb(struct sock *sk, struct sk_buff *skb)

{

	__skb_unlink(skb, &sk->sk_receive_queue);
@@ -1756,34 +1761,26 @@ int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor) 
	if (sk->sk_state == TCP_LISTEN)

		return -ENOTCONN;



	while ((skb = tcp_recv_skb(sk, seq, &offset)) != NULL) {

		int used;

	skb = tcp_recv_skb(sk, seq, &offset);

	if (!skb)

		return 0;



	__skb_unlink(skb, &sk->sk_receive_queue);

		used = recv_actor(sk, skb);

		if (used <= 0) {

			if (!copied)

				copied = used;

			break;

		}

		seq += used;

		copied += used;



		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) {

			consume_skb(skb);

	WARN_ON(!skb_set_owner_sk_safe(skb, sk));

	copied = recv_actor(sk, skb);

	if (copied >= 0) {

		seq += copied;

		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)

			++seq;

			break;

	}

	consume_skb(skb);

		break;

	}

	WRITE_ONCE(tp->copied_seq, seq);



	tcp_rcv_space_adjust(sk);



	/* Clean up data we have read: This will do ACK frames. */

	if (copied > 0)

		tcp_cleanup_rbuf(sk, copied);

		__tcp_cleanup_rbuf(sk, copied);



	return copied;

}